Session Initiation Protocol Application Layer Gateway (SIP ALG) is a firewall or router feature that inspects VoIP signaling and rewrites SIP packets so voice calls can cross NAT boundaries. In practice, it may adjust addresses and ports in SIP headers or help open temporary pinholes for media streams.
In cyber security, SIP ALG matters because it changes traffic at the network edge. If it is buggy or enabled where it is not needed, it can break calls, expose services unexpectedly, or create unusual parsing paths that attackers may target. Security teams often review SIP ALG during hardening, especially on appliances that also handle NAT, VPN, or remote access. When defenders know whether SIP ALG is enabled, they can reduce attack surface, validate only the required VoIP paths, and apply vendor patches to any feature-specific flaw.